gwdf48x[.]xyz

The domain gwdf48x.xyz is a generic phishing site designed to steal user credentials or sensitive information. It does not impersonate a specific brand or use a known drainer kit. As of the latest verification, gwdf48x.xyz has been taken offline, but it previously posed an elevated risk to visitors.

Technical analysis shows that gwdf48x.xyz was flagged by 3 of 95 VirusTotal security vendors, including Forcepoint ThreatSeeker, Gridinsoft, and Trustwave. It was listed on 1 security blocklist (PhishDestroy) and was not flagged by Google Safe Browsing. The domain was registered through ripencc on August 29, 2024, and resolved to the IP address 91.215.43.30, hosted by AS57724 (DDOS-GUARD LTD) in Russia. No SSL certificate was available, and the observed page title was 'GET-X'. Gridinsoft assigned it a trust score of 0/100, further indicating its malicious nature.

Users who may have interacted with gwdf48x.xyz should immediately change any credentials entered on the site, enable two-factor authentication (2FA) on affected accounts, and monitor for unauthorized activity. If financial or crypto-related information was exposed, consider revoking token approvals and transferring funds to a new wallet. Report the domain to relevant authorities or platforms, such as the Anti-Phishing Working Group (APWG) or local cybersecurity organizations, to aid in mitigation efforts.